Can An Employer Read WhatsApp Messages At Work?

WhatsApp is handy at work until something goes wrong. A team chat might contain customer details, shift changes, complaints about a manager or a screenshot you now need for a disciplinary issue.

If you run a business, it's completely reasonable to want visibility over work communications. The tricky part is that WhatsApp often sits in the middle of work life and private life, especially when staff use their own phones.

The good news is that you can manage this without overcomplicating it. The key is to be clear about what counts as work communication, what you may monitor, and how you'll handle evidence fairly.

Can An Employer Read WhatsApp Messages?

It depends - you may be able to read work-related WhatsApp messages in limited circumstances, but you shouldn't casually access an employee's private WhatsApp chats.

The starting point is simple: employees still have privacy rights at work. In the UK, monitoring employee messages is mainly governed by the UK GDPR, the Data Protection Act 2018 and general employment law duties of fairness and trust.

If the messages are in a work WhatsApp group that you created for your business, or on a company phone used for work, you'll usually have a stronger reason to access them. Even then, your access needs to be:

• Lawful: You need a lawful basis under UK GDPR, often legitimate interests rather than consent.
• Fair and transparent: Staff should receive a clear employee monitoring notice explaining what you may monitor and why.
• Proportionate: You should only access what you actually need.
• Secure: Screenshots, exports and notes should be kept safely and shared only with people who need them.

If the messages are on an employee's personal phone in a private chat, the answer is very different. You generally shouldn't demand to scroll through their phone or personal WhatsApp account unless there's a very specific and serious reason, and even then you should get tailored advice first.

A safer approach is to ask the employee or another relevant person to provide the specific messages needed for the work issue, rather than taking broad access to the device.

What Counts As A Work WhatsApp Message?

A work WhatsApp message is usually a message sent for your business, about your business, or through a channel your business has set up for work purposes.

This isn't always as obvious as it sounds. A chat can start as a practical way to cover shifts, then slowly become a space for jokes, complaints, customer information and sensitive staff issues.

For example, say Priya runs a small catering business in Manchester with 18 staff. She has a WhatsApp group called Friday Events Team. Staff use it to confirm arrival times, share venue addresses and report stock shortages. Those messages are clearly work-related.

But if two employees also have a private WhatsApp chat where they discuss Priya, their pay and weekend plans, that isn't automatically something Priya can access just because they work for her.

In practice, you should look at factors such as:

• Who set up the chat and who controls it
• Whether the chat is used mainly for work tasks
• Whether customers, suppliers or confidential business information are discussed
• Whether the device is company-owned or personal, including for remote work
• What your staff handbook, privacy notice and work WhatsApp policy say

Be especially careful if messages include health information, trade union views, disciplinary allegations, criminal offence data or other sensitive personal data. UK GDPR gives special protection to this kind of information, and you may need an extra condition for processing it.

Can You Monitor Employee WhatsApp Messages In The UK?

Yes, you can monitor some employee messages in the UK, but only where you have a clear business reason, have told staff about it and keep the monitoring proportionate.

The Information Commissioner's Office expects employers to be open with staff about workplace monitoring. Secret monitoring should be exceptional and usually only considered where there's suspected serious misconduct and telling staff would prejudice the investigation.

For most small businesses, the lawful basis under UK GDPR will be legitimate interests. That means you identify your business interest, check whether monitoring is necessary, and balance it against the employee's privacy rights.

Common legitimate reasons include:

• Protecting customer information
• Investigating harassment, bullying or discrimination complaints
• Checking compliance with health and safety procedures
• Protecting confidential information, information security and intellectual property
• Investigating suspected fraud, theft or serious misconduct

Consent is usually not the best basis for employee monitoring because the employment relationship isn't equal. An employee may not feel they can freely say no.

What A Proportionate Approach Looks Like

Proportionate monitoring means you avoid the fishing expedition. If you're investigating a complaint about one shift, you probably don't need months of unrelated chat history.

A sensible approach might be to:

1. Define the issue you're investigating.
2. Identify which WhatsApp group or conversation is relevant.
3. Collect only the messages needed for that issue.
4. Blur or remove unrelated private information where possible.
5. Limit access to the manager, HR adviser or external adviser handling the matter.
6. Keep the messages only for as long as needed.

If your planned monitoring is high-risk, intrusive or uses technology to watch staff at scale, you may need a data protection impact assessment before you start.

Can You Use WhatsApp Messages In A Disciplinary Process?

Yes, you may be able to use WhatsApp messages in a disciplinary process, but the evidence should be collected fairly and handled carefully.

The Employment Rights Act 1996 and ACAS Code of Practice on disciplinary and grievance procedures matter here. If you unreasonably fail to follow the ACAS Code, an employment tribunal can increase certain compensation awards by up to 25%.

That doesn't mean every disciplinary process needs to feel like a court case. It does mean you should give the employee a fair chance to understand and respond to the evidence before you make a decision.

Worked Example

Mike runs a cleaning business with 12 employees. A supervisor sends him 14 screenshots from a work WhatsApp group showing one employee repeatedly sharing customer alarm codes and making comments about skipping site checks.

Mike shouldn't simply dismiss the employee on the spot. A safer process would be:

1. Save the screenshots securely and record who provided them and when.
2. Check the wider context, including whether any messages are missing.
3. Consider whether the messages involve confidential customer information.
4. Invite the employee to a disciplinary meeting and share the relevant evidence in advance.
5. Let the employee bring a companion where the statutory right applies.
6. Make a decision based on the evidence, the employment contract, policies, seriousness and any explanation.
7. Confirm the outcome in writing and offer an appeal where appropriate.

If Mike has a clear confidentiality policy, monitoring notice and work WhatsApp policy, he is in a much better position. Without those documents, he may still be able to act, but the process is likely to be messier and easier to challenge.

What Should Your Work WhatsApp And BYOD Policy Say?

Your policy should explain when staff can use WhatsApp for work, what isn't allowed, and what monitoring may happen.

If staff use their own phones for work, you should also have a bring your own device policy. This is where many businesses get caught out. The phone belongs to the employee, but some of the information on it may belong to your business or your customers.

A good policy doesn't need to ban WhatsApp completely. For many small businesses, that would be unrealistic. Instead, it should set boundaries that are easy to follow.

Work WhatsApp And BYOD Policy Outline

Here is a practical outline you can adapt before getting it tailored for your business. Treat it as a starting point, not a finished legal document.

1. Purpose: Explain why your business uses WhatsApp and which teams or roles it applies to.
2. Approved Channels: List the groups, accounts or numbers staff can use for work communications.
3. Business Information: Say what information can and can't be shared on WhatsApp, especially customer data and confidential information.
4. Personal Devices: Set rules for staff using their own phones, including passcodes, screen locks and reporting lost devices.
5. Monitoring Notice: Explain what you may monitor, why, how often and who may access the information.
6. Private Use: Make clear that private chats aren't normally accessed, but work-related evidence may be reviewed where necessary.
7. Customer Data: Set limits on sharing personal data, photos, addresses, health information or payment details.
8. Leaving The Business: Explain what staff must delete, return or transfer when their employment ends.
9. Misuse: Link misuse to your disciplinary policy, harassment policy and confidentiality obligations.
10. Questions And Reporting: Tell staff who to contact if they're unsure or if something goes wrong.

Templates can miss the details that matter, especially if your staff handle sensitive customer data or use personal devices daily. It's worth tailoring the wording to how your team actually works.

What Should You Do If Something Has Already Gone Wrong?

If a WhatsApp issue has already happened, your first step is to pause and preserve the relevant evidence without spreading it further.

It's easy to make things worse by forwarding screenshots widely, confronting staff in the group chat or demanding immediate access to a personal phone. Try to keep the response calm and contained.

A practical first response is:

1. Secure The Evidence: Save relevant screenshots or exports, noting the date, time, sender and who provided them.
2. Limit Access: Share the material only with people who genuinely need it, such as the decision-maker or HR adviser.
3. Check Your Policies: Review your employment contracts, employee privacy notice, disciplinary policy, confidentiality terms and any BYOD policy.
4. Identify The Risk: Work out whether the issue involves misconduct, data protection, confidentiality, harassment, safety or customer harm.
5. Avoid Over-Collection: Don't collect whole chat histories if a smaller set of messages will do.
6. Plan The Process: Decide whether you need an informal discussion, investigation meeting, disciplinary process or data breach assessment.
7. Get Help Early: If dismissal, discrimination, whistleblowing, special category data or a serious customer data issue is involved, get advice before acting.

If personal data has been disclosed to the wrong person or put at risk, you may also need to assess whether it's a personal data breach under UK GDPR. Some breaches must be reported to the ICO within 72 hours of becoming aware of them, so don't leave that assessment until next week.

Key Takeaways

• You can sometimes read work WhatsApp messages, but you need a lawful basis, a clear business reason and a proportionate approach.
• Private WhatsApp chats on personal phones are much harder to access lawfully, even if work is mentioned.
• A work WhatsApp policy and bring your own device policy help you set expectations before problems arise.
• WhatsApp evidence can be used in a disciplinary process, but it should be collected fairly and handled under a proper process.
• Customer data, health information, confidential business information and harassment complaints need extra care.
• If a serious issue has already happened, preserve the evidence, limit who sees it and get tailored advice before taking major action.

If you'd like help with your work WhatsApp policy, BYOD rules, monitoring notices or disciplinary process, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.